> I'm glad the work was contributed upstream and is useful to Pyodide and Cloudflare. But I think there is a meaningful difference between funding a contribution to an upstream project and funding the upstream maintainers who have to support it afterwards.

Any of the upstream maintainers consider blocking merge unless Cloudflare signs a support contract?

Not an easy process to navigate, but if you find an internal champion that can help make the case, maintenance can be funded. For critical deps, companies are generally down to budget some financial support if you ask and know how to work the process.